mapping from tags to tainted addresses - data-flow only